Expense Reporting and Reimbursement Checklist

Open the report in the expense system (SAP Concur, Expensify, Ramp, Brex, or Navan) and confirm the submission is complete and the cost-center coding matches the employee's home department in the GL.

IRS accountable-plan rules (Reg. §1.62-2) require expenses to be substantiated within a reasonable time — most policies set 60 days from the transaction date. Reports submitted late convert to taxable wages and must be flagged for payroll, not AP.

Cross-reference GSA CONUS rates or the company's tiered city schedule. Common gotchas: high-cost cities (NYC, SF, DC) use a different cap, and the first/last travel day is typically reimbursed at 75%.

Each line should hit the right travel/meals/supplies account and carry the correct class, location, or project dimension. Misposted client-billable expenses are a common rework item — flag any project-coded line missing a customer reference.

IRS Pub 463 sets the documentation threshold at $75; most company policies tighten it to $25 or require receipts for all meals regardless. The receipt must show vendor, date, amount, and itemized detail — a credit-card slip alone is not substantiation.

Meals require attendees, business purpose, and amount under TCJA rules. Entertainment is non-deductible after 2017 — if a charge looks like entertainment (sports tickets, golf), it should be coded to a non-deductible account and excluded from the M-1 deduction at year-end.

Match each Amex/Brex/Ramp transaction to a report line. Unmatched card charges sitting in the suspense GL account at month-end are the most common reconciling item on the corporate-card clearing rec.

Confirm mileage is computed at the current IRS business rate (67¢/mile for 2024; 70¢/mile for 2025) and that the log shows date, origin, destination, and business purpose. Commute miles are not reimbursable.

First-line approval verifies the business purpose. Reports older than 5 business days without manager action should be escalated — stale approvals are the top complaint from employees waiting on reimbursement.

Most policies require a second-level approval above $2,500 or for any policy exception (out-of-policy hotel, missing receipt affidavit, prior-period charge). Mark the report for escalation if either threshold is hit.

Send a one-page exception memo identifying the policy section breached, the dollar impact, and the manager's recommendation. CFO approval should be captured in the expense system audit trail, not just an email.

Use the expense system's audit-rule engine (Concur Audit, Expensify Concierge) or a manual sample. Stratify the sample so all reports above $5,000 are audited 100% and smaller reports are sampled at 10%.

Common fraud patterns: same receipt submitted twice across periods, single charge split into multiple lines to dodge approval thresholds, or personal charges coded to a project that's about to close. Run the duplicate-detection report and review hits.

Material exceptions trigger the firm's fraud-response protocol: hold the reimbursement, preserve workpapers, notify HR and the controller, and document the chain of evidence before contacting the employee.

Confirm the routing/account number on file in payroll or AP matches a recent voided check or direct-deposit record. Banking-detail change requests via email are a common business email compromise vector — require a phone-back to a known number.

Release the batch in Bill.com, Ramp, or the bank portal. Most companies pay reimbursements on the same weekly cycle as vendor bills; same-day push is reserved for emergency travel advances.

Confirm the sync from the expense system to QuickBooks/NetSuite/Sage Intacct posted cleanly: expense accounts debited, employee-reimbursement clearing credited, and the cash credit hits when the ACH clears. Investigate any sync errors before close.

IRS Pub 463 requires retention of substantiation for at least 3 years from the return due date; many firms keep 7. Store receipts and the approval audit trail in the document-management system, not on local drives — your WISP almost certainly requires it.